VHA Local BAA Template Aug2023.rtf

BUSINESS ASSOCIATE AGREEMENT BETWEEN THE DEPARTMENT OF VETERANS AFFAIRS VETERANS HEALTH ADMINISTRATION, Hunter Holmes McGuire VA Health Care System AND <COMPANY/ORGANIZATION>

Template Revised August 2023

Purpose. The purpose of this Business Associate Agreement (Agreement) is to establish requirements for the Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Hunter Holmes McGuire VA Health Care System and <Company/Organization> in accordance with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH) Act, and the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (“HIPAA Rules”), 45 C.F.R. Parts 160 and 164, for the Use and Disclosure of Protected Health Information (PHI) under the terms and conditions specified below.

Scope. As described in this Agreement and any other applicable contracts or agreements, <COMPANY/ORGANIZATION> will provide the following services to, for, or on behalf of VHA:

Services Services

In order for <COMPANY/ORGANIZATION> to provide such services, <Insert Facility Name> will provide PHI to <COMPANY/ORGANIZATION>, and

<COMPANY/ORGANIZATION> will use or disclose PHI in accordance with this Agreement.

Definitions. Unless otherwise provided, the following terms used in this Agreement have the same meaning as defined by the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, PHI, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured PHI, and Use.

“Breach” shall have the same meaning as described at 45 C.F.R. § 164.402. For the purposes of this Agreement, Breach shall refer to an acquisition, access, use, or disclosure of PHI in a manner not permitted by the HIPAA Rules or by this Agreement.

“Business Associate” shall have the same meaning as described at 45 C.F.R.

§ 160.103. For the purposes of this Agreement, Business Associate shall refer to <COMPANY/ORGANIZATION>, including its employees, officers, or any other agents that create, receive, maintain, or transmit PHI as described below.

“Covered Entity” shall have the same meaning as the term is defined at 45 C.F.R. § 160.103. For the purposes of this Agreement, Covered Entity shall refer to

VHA.

“Incident” shall have the same meaning as described in VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which is an event that has resulted in, or had the potential to result in, unauthorized access to or disclosure of VA sensitive personal information in a manner not permitted under the applicable confidentiality provisions. An incident that involves access or disclosure of PHI in a manner not permitted under the HIPAA Privacy Rule is presumed to be a breach unless Business Associate demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment using at least the listed factors in the Breach Notification Rule.

“Protected Health Information” or “PHI” shall have the same meaning as described at 45 C.F.R. § 160.103. “Protected Health Information” and “PHI” as used in this Agreement include “Electronic Protected Health Information” and “EPHI.” For the purposes of this Agreement and unless otherwise provided, the term shall also refer to PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity or receives from Covered Entity or from another Business Associate of Covered Entity.

“Sensitive Personal Information” or “SPI,” as defined in 38 U.S.C § 5727, any information about an individual maintained by VA, including education, financial transaction, medical history, and criminal or employment history; information that can be used to distinguish or trace the individual’s identity, including name, social security number, date and place of birth, mother’s maiden name, or biometric records; and information that requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of information. For the purpose of this agreement PHI and SPI are interchangeable.

“Subcontractor” shall have the same meaning as the term is defined at 45 C.F.R. § 160.103. For the purposes of this Agreement, Subcontractor shall refer to a contractor of any person or entity, other than Covered Entity or Business Associate, that creates, receives, maintains, or transmits PHI under the terms of this Agreement.

Terms and Conditions. Covered Entity and Business Associate agree as follows:

Ownership of PHI. PHI is and remains data owned by Covered Entity as long as Business Associate creates, receives, maintains, or transmits PHI, regardless of whether a compliant Business Associate Agreement is in place.

Use and Disclosure of PHI by Business Associate. Unless otherwise provided, Business Associate:

May not use or disclose PHI other than as permitted or required by this Agreement, or in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity, except that it may use or disclose PHI:

Must use or disclose PHI in a manner that complies with Covered Entity’s minimum necessary policies and procedures as provided in VHA Directive 1605.02, Minimum Necessary Standard.

May de-identify PHI created or received by Business Associate under this Agreement, provided that the de-identification conforms to the requirements of the HIPAA Privacy Rule and that such de-identified information is used solely for purposes of providing or improving Business Associate’s services for Covered Entity or for another lawful purpose approved in advance and in writing by Covered Entity. Business Associate shall not sell or market de-identified data sets created from PHI.

Obligations of Business Associate. In connection with any Use or Disclosure of PHI, Business Associate must:

Consult with Covered Entity before using or disclosing PHI whenever Business Associate is uncertain whether the Use or Disclosure is authorized under this Agreement.

Implement appropriate administrative, physical, and technical safeguards and controls to protect PHI and document applicable policies and procedures to prevent any Use or Disclosure of PHI other than as provided by this Agreement.

Provide satisfactory assurances that PHI created or received by Business Associate under this Agreement is protected in accordance with this Agreement and applicable law to the greatest extent feasible.

Notify Covered Entity no later than by midnight following the next business day after Business Associate’s discovery (as described in (1) below) of any incident, such as a potential access, acquisition, use, disclosure, modification, or destruction of either secured or unsecured PHI in violation of this Agreement “that

(A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of VA information or a VA information system” accessible by VA users “or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies,” per the Federal Information Security Management Act, 44 USC 3501-3518. The parties acknowledge and agree that this section does not apply to incidents that are trivial and do not result in unauthorized access, use, or disclosure of PHI that is Electronic Protected Health Information, including without limitation pings and other broadcast attacks on <COMPANY ORGANIZATION> firewall, port scans, unsuccessful log-on attempts, and denials of service attacks, or other failed attempts does not need to be reported and no additional notice to VHA shall be required.

For purposes of this notification, an incident as described above will be treated as discovered by Business Associate when such event is known to any employee, officer, or other agent (other than the individual who committed the incident) of Business Associate or, by exercising reasonable diligence, would have been known to an employee, officer, or other agent of Business Associate.

Notification shall be sent to the Marie Montamabadou, Marie.Montamabadou@va.gov"